diff mbox series

[6/8] manual: Document default AT_SECURE handling for system-wide tunables

Message ID 20260706211524.3801466-7-adhemerval.zanella@linaro.org (mailing list archive)
State New
Headers
Series Fixes for the system-wide tunables support |

Checks

Context Check Description
redhat-pt-bot/TryBot-apply_patch success Patch applied to master at the time it was sent
linaro-tcwg-bot/tcwg_glibc_build--master-aarch64 fail Patch failed to apply
linaro-tcwg-bot/tcwg_glibc_build--master-arm fail Patch failed to apply

Commit Message

Adhemerval Zanella July 6, 2026, 9:14 p.m. UTC 
  A system-wide tunable without an onlysecure/nonsecure/anysecure prefix
defaults to "nonsecure", i.e. it is not applied to AT_SECURE processes.
This is a deliberate, conservative default but was not documented.
---
 manual/tunables.texi | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

Comments

DJ Delorie July 9, 2026, 2:25 a.m. UTC | #1 
Adhemerval Zanella <adhemerval.zanella@linaro.org> writes:
> +every setuid or setgid program.  The file is therefore trusted to the same

Perhaps s/The file/The config file/ to make it less ambiguous.  On first
reading (the diff, so out of context), I couldn't figure out why you say
the cache file should be as secure as the cache file...

LGTM otherwise
Reviewed-by: DJ Delorie <dj@redhat.com>
Adhemerval Zanella July 9, 2026, 12:01 p.m. UTC | #2 
On 08/07/26 23:25, DJ Delorie wrote:
> 
> Adhemerval Zanella <adhemerval.zanella@linaro.org> writes:
>> +every setuid or setgid program.  The file is therefore trusted to the same
> 
> Perhaps s/The file/The config file/ to make it less ambiguous.  On first
> reading (the diff, so out of context), I couldn't figure out why you say
> the cache file should be as secure as the cache file...

Ack, I fixed locally.

> 
> LGTM otherwise
> Reviewed-by: DJ Delorie <dj@redhat.com>
>
diff mbox series

Patch

diff --git a/manual/tunables.texi b/manual/tunables.texi
index 828c68151ad..457dbb1d18b 100644
--- a/manual/tunables.texi
+++ b/manual/tunables.texi
@@ -143,6 +143,22 @@  processes.
 
 @end table
 
+When none of the @code{onlysecure}, @code{nonsecure} or @code{anysecure}
+prefixes is given, a tunable behaves as if @code{nonsecure} had been
+specified: it applies only to processes that are not AT_SECURE.  Use
+@code{anysecure} or @code{onlysecure} to affect AT_SECURE (setuid,
+setgid, or capability-elevated) processes.
+
+The @code{GLIBC_TUNABLES} environment variable is ignored entirely for
+AT_SECURE processes, so the system-wide file is the only way to set a
+tunable for such a process.  A tunable applied this way is not subject to
+any per-tunable security screening, so @code{onlysecure} and
+@code{anysecure} must be used deliberately: they can enable
+security-sensitive tunables (for example @code{glibc.malloc.check}) in
+every setuid or setgid program.  The file is therefore trusted to the same
+degree as @file{/etc/ld.so.cache} and must only be writable by the system
+administrator.
+
 Filters make the system-wide tunables only affect certain programs.
 This allows having a non-overridable default for most of the system
 but a different, overridable, value for certain programs that might